On-Premise ServiceNOW & MFA with Hardware Security Key

[OzoneTrip]

Hi,

We are setting up an on-premise ServiceNOW instance and we have a requirement to set up MFA with a roaming authenticator utilizing the FIDO2 process (in our case, a hardware security key).

Our instance will not have a direct access to public internet, so I am wondering whether it requires one? Does the instance authenticate the connection with an external WebAuthn Relying Party/FIDO2 Server or do we have to set up one for ourselves?

If we do, where do we modify the endpoint parameters? I see some references to SNC.GlideAuthenticationFactor in the script but I can't find any documentation related to it.

Any help with this matter would be appreciated!

Thank you!

BR,
Aleksi

[Damian14]

Question for you. Have you been able to register more than one hardware security key? I'm can't seem to get SN to allow a second hardware key to register. 

A reply to your question. I would use the keys for MFA even if you are on-prem. If your users have hardware keys already, they are already use to using them. Using a hardware key for MFA is less work then email OTP or using an Authenticator App (which requires a mobile phone). And hardware keys (or more exactly U2F, FIDO2, webauthn) aren't vulnerable to any sort of in-the-middle attack. 

[OzoneTrip]

We are still setting the instances up so we aren't at the stage yet to be able to register any hardware keys.

Yes, we have a requirement for using the hardware keys.

The problem is that our on-prem instance will not have access to the internet, so we will need to figure out another way to complete the authentication process using the Relying Party if SN utilizes a 3rd party Relying Party.

[Damian14]

One of the benefits of using hardware security keys is that you don't need the internet to register them and/or authenticate with them. 

Damian 

[OzoneTrip]

Ah, that is interesting.

That means that ServiceNOW is the Relying Party in FIDO2 process.
I wonder if I can override the SSL requirement somehow (since we don't have certifications for our sandbox environment).